# GDPR compliance This document explains how commercetools supports merchants in deleting the personal data of customers in compliance with the European Union's Data Protection Regulation (GDPR). If a customer asks for a complete record of their personal data collected by you, the merchant, refer to our [resources supporting the storage of personal data](/api/customers-overview.md#customer-permissions). This document outlines the retrieval and deletion of such data in a manner compliant with GDPR. As a merchant, review your data model carefully to ensure that no other resource (for example [Product](/urn?urn=ctp%3Aapi%3Atype%3AProduct) or [Category](/urn?urn=ctp%3Aapi%3Atype%3ACategory)) contains or refers to personal data. This document is informational and **does not constitute legal advice**. ## Retrieval of collected data For each of the [resources supporting the storage of personal data](/api/customers-overview.md#customer-permissions), it is possible to conduct customer-specific retrievals. Here is an overview of the retrievals needed to be performed: - Customer: [Get Customer](/api/projects/customers.md#get-customer) - Cart: [Get Cart by Customer ID](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fcarts%2Fcustomer-id%3D%7BcustomerId%7D%3AGET) - Order: [Query Order](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Forders%3AGET) using Customer ID in Predicate - Payment: [Query Payment](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fpayments%3AGET) using Customer ID in Predicate - Review: [Query Review](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Freviews%3AGET) using Customer ID in Predicate - Shopping List: [Query ShoppingLists](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fshopping-lists%3AGET) using Customer ID in Predicate - Discount Code: [Query CartDiscounts](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fcart-discounts%3AGET) with Discount Code required where Cart Predicate contains Customer ID - Custom Object: [Query CustomObjects in Container](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fcustom-objects%2F%7Bcontainer%7D%3AGET) with reference to the customer-related identifier in Predicate - Message: [Query Messages](/api/projects/messages.md) for all resource identifiers returned from the above queries - Business Unit : [Query BusinessUnit](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fbusiness-units%3AGET) checking for a matching Customer ID in the Associates of the Business Unit using a Predicate - Quote: [Query Quotes](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fquotes%3AGET) using Customer ID in Predicate - Quote Request: [Query QuoteRequests](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fquote-requests%3AGET) using Customer ID in Predicate - Staged Quote: [Query StagedQuotes](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fstaged-quotes%3AGET) using Customer ID in Predicate To ease the retrieval process, commercetools offers a data erasure tool available on [GitHub](https://commercetools.github.io/nodejs/cli/personal-data-erasure/). This open-source NodeJS tool facilitates bulk retrieval for all listed resources and is customizable to fit your specific data model, including Custom Objects and Types. ## Data erasure of personal data If a customer exercises their right to be forgotten, requesting the deletion of their data, be aware that a standard DELETE request might not remove all data. A DELETE request will for example not erase personal data that are part of [Messages](/api/projects/messages.md), or from the logs that commercetools keeps internally for some time to reconstruct data in case of faulty system behavior. To ensure GDPR compliance, a `dataErasure` parameter is available in DELETE requests. When set to `true`, it ensures the removal of all personal data related to the object, including [Messages](/api/projects/messages.md) and internal logs. Here are the endpoints for GDPR-compliant deletion (set `dataErasure=true`): - [Delete Customer](/api/projects/customers.md#delete-customer) - [Delete Cart](/api/projects/carts.md#delete-cart) - [Delete Order](/api/projects/orders.md#delete-order) - [Delete Payment](/api/projects/payments.md#delete-payment) - [Delete Review](/api/projects/reviews.md#delete-review) - [Delete ShoppingList](/api/projects/shoppingLists.md#delete-shoppinglist) - [Delete DiscountCode](/api/projects/discountCodes.md#delete-discountcode) - [Delete CustomObject](/urn?urn=ctp%3Aapi%3Aendpoint%3A%2F%7BprojectKey%7D%2Fcustom-objects%2F%7Bcontainer%7D%2F%7Bkey%7D%3ADELETE) - [Delete BusinessUnit](/api/projects/business-units.md#delete-businessunit) - [Delete Quote](/api/projects/quotes.md#delete-quote) - [Delete QuoteRequest](/api/projects/quote-requests.md#delete-quoterequest) - [Delete StagedQuote](/api/projects/staged-quotes.md#delete-stagedquote) Use the [open-source NodeJS tool](https://commercetools.github.io/nodejs/cli/personal-data-erasure/) for bulk deletion and customization for Custom Objects and Types. ## Traceability of collected data If a customer requires evidence of actions taken on their data, contact the [commercetools support team](https://support.commercetools.com/) with a request that includes the [Customer ID](/api/projects/customers.md#customer) and the resource identifiers for which the change history is needed. They will provide a list of Messages documenting individual changes to each resource. For any changes performed on a resource within the Merchant Center after 25 May 2018, Change History will include the User ID of the individual who performed the change. ## Related pages - [Area overview page with navigation](/api.md) - [Previous page: API Clients](/api/projects/api-clients.md) - [Next page: Private connectivity](/api/private-connectivity.md)